@jmtrin/opencode-kevin 1.1.0 → 1.3.0

package/dist/plugin/ToolCallObserver.js

@@ -1,201 +0,0 @@
-import { hasColumn } from "./columns.js";
-import { fingerprint as computeFingerprint } from "./fingerprint.js";
-import { redactPaths, stripPrivate } from "./redact.js";
-import { uuidv7 } from "./uuid.js";
-const SECRET_PATTERNS = [
-    /\b(API_KEY|SECRET|PASSWORD|TOKEN)\b\s*[=:]\s*\S+/gi,
-    /\bBearer\s+\S+/gi,
-    // BUG-013 — the old `\btoken\s+\S+/gi` mangled harmless phrasing
-    // ("token budget", "token count", "max token limit") that LLM tools
-    // emit routinely. Narrowed to credential contexts: named token
-    // variables WITH an assignment, and `token=<value>` / `token:
-    // <value>` assignments.
-    /\b(access_?token|auth_?token|api_?token)\b\s*[=:]\s*\S+/gi,
-    /\btoken\s*[=:]\s*\S+/gi,
-];
-export class ToolCallObserver {
-    store;
-    startTs = new Map();
-    metrics;
-    constructor(store, metrics) {
-        this.store = store;
-        this.metrics = metrics ?? null;
-    }
-    onBefore(input, _output) {
-        const key = this.key(input);
-        this.startTs.set(key, Date.now());
-    }
-    onAfter(input, output) {
-        const key = this.key(input);
-        const start = this.startTs.get(key) ?? Date.now();
-        this.startTs.delete(key);
-        const durationMs = Math.max(0, Date.now() - start);
-        const sessionId = input.sessionId ?? "unknown";
-        const argsSummary = this.summarizeArgs(input.args ?? {});
-        const success = output.success === true ? 1 : 0;
-        const agent = input.agent ?? null;
-        const stderr = stripPrivate(output.stderr ?? "");
-        const stdout = stripPrivate(output.stdout ?? "");
-        const errorType = output.success === false
-            ? this.inferErrorType(stderr, stdout, output.exitCode)
-            : null;
-        const metadata = JSON.stringify(this.redactArgs(input.args ?? {}));
-        const projectId = input.projectId ?? null;
-        const fp = computeFingerprint(`${input.tool}|${argsSummary}|${success}`, projectId ?? undefined);
-        if (this.isDedupEnabled()) {
-            const existing = this.store
-                .prepare(`SELECT 1 FROM tool_calls
-					 WHERE fingerprint = ?
-					   AND (project_id IS ? OR (project_id IS NULL AND ? IS NULL))
-					   AND strftime('%Y-%m-%d %H:%M', ts) = strftime('%Y-%m-%d %H:%M', 'now')
-					 LIMIT 1`)
-                .get(fp, projectId, projectId);
-            if (existing) {
-                this.metrics?.incr("tool_calls_deduped", 1);
-                return;
-            }
-        }
-        // v1.1.0 (K11-002 / plan §5.2, D11-01/D11-07) — dual-write: legacy `ts`
-        // stays (`datetime('now')`), new `ts_ms` holds Date.now() when the
-        // column exists. Probe is cached via columns registry (K11-011).
-        if (hasColumn(this.store, "tool_calls", "ts_ms")) {
-            this.store
-                .prepare(`INSERT INTO tool_calls
-					 (id, session_id, ts, ts_ms, tool, args_summary, success, duration_ms, agent, error_type, metadata, project_id, fingerprint)
-					 VALUES (?, ?, datetime('now'), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(input.callID ?? uuidv7(), sessionId, Date.now(), input.tool, argsSummary, success, durationMs, agent, errorType, metadata, projectId, fp);
-        }
-        else {
-            this.store
-                .prepare(`INSERT INTO tool_calls
-					 (id, session_id, ts, tool, args_summary, success, duration_ms, agent, error_type, metadata, project_id, fingerprint)
-					 VALUES (?, ?, datetime('now'), ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(input.callID ?? uuidv7(), sessionId, input.tool, argsSummary, success, durationMs, agent, errorType, metadata, projectId, fp);
-        }
-    }
-    isDedupEnabled() {
-        try {
-            const row = this.store
-                .prepare("SELECT value FROM kevin_settings WHERE key = 'tool_calls_dedup_enabled'")
-                .get();
-            return row?.value === "1";
-        }
-        catch {
-            return false;
-        }
-    }
-    redactSecrets(text) {
-        let out = text;
-        for (const pat of SECRET_PATTERNS) {
-            out = out.replace(pat, (match) => {
-                // BUG-013 — preserve the original separator so
-                // `auth_token = abc123` keeps its spacing: only the
-                // value is replaced.
-                const m = match.match(/^(.+?)(\s*[=:]\s*)(\S+)$/);
-                if (m) {
-                    return `${m[1]}${m[2]}<redacted>`;
-                }
-                const parts = match.split(/\s+/);
-                return `${parts[0]} <redacted>`;
-            });
-        }
-        return out;
-    }
-    summarizeArgs(args) {
-        const interestingKeys = [
-            "filePath",
-            "path",
-            "cwd",
-            "command",
-            "cmd",
-            "file",
-            "directory",
-        ];
-        const parts = [];
-        for (const [k, v] of Object.entries(args)) {
-            if (interestingKeys.includes(k)) {
-                parts.push(`${k}: ${this.redactValue(v)}`);
-            }
-            else if (this.looksSecret(k)) {
-                parts.push(`${k}: <redacted>`);
-            }
-            else {
-                parts.push(`${k}: ${this.redactValue(v, 200)}`);
-            }
-        }
-        let summary = parts.join(", ");
-        if (summary.length > 500)
-            summary = `${summary.slice(0, 500)}...`;
-        return summary;
-    }
-    inferErrorType(stderr, stdout, exitCode) {
-        const combined = `${stderr}\n${stdout}`.toLowerCase();
-        if (exitCode === 124 ||
-            /timed out|timeout|etimedout|\bkilled\b|sigterm|sigkill/.test(combined)) {
-            return "timeout";
-        }
-        if (/error ts|tsc|\btypescript\b/.test(combined))
-            return "typecheck";
-        if (/\b(lint|biome|eslint)\b/.test(combined))
-            return "lint";
-        if (/\b(fail|vitest|jest|test failed)\b/.test(combined))
-            return "test";
-        if (/error:|typeerror|referenceerror|syntaxerror/.test(combined))
-            return "runtime";
-        if ((exitCode === undefined || exitCode === -1) &&
-            stderr.trim() === "" &&
-            stdout.trim() === "") {
-            return "timeout";
-        }
-        return "unknown";
-    }
-    key(input) {
-        if (input.callID)
-            return `callID::${input.callID}`;
-        const argsKey = JSON.stringify(input.args ?? {});
-        return `${input.sessionId ?? "unknown"}::${input.tool}::${argsKey}`;
-    }
-    looksSecret(key) {
-        const k = key.toLowerCase();
-        return /(key|secret|password|token|bearer)/.test(k);
-    }
-    redactArgs(args) {
-        const out = {};
-        for (const [k, v] of Object.entries(args)) {
-            if (this.looksSecret(k)) {
-                out[k] = "<redacted>";
-            }
-            else {
-                out[k] = this.redactValue(v);
-            }
-        }
-        return out;
-    }
-    redactValue(v, truncateAt) {
-        if (typeof v === "string") {
-            let s = stripPrivate(v);
-            s = redactPaths(s);
-            s = this.redactSecrets(s);
-            if (truncateAt !== undefined && s.length > truncateAt) {
-                s = `${s.slice(0, truncateAt)}...`;
-            }
-            return s;
-        }
-        if (Array.isArray(v)) {
-            return v.map((item) => this.redactValue(item));
-        }
-        if (v && typeof v === "object") {
-            const obj = {};
-            for (const [k, val] of Object.entries(v)) {
-                if (this.looksSecret(k)) {
-                    obj[k] = "<redacted>";
-                }
-                else {
-                    obj[k] = this.redactValue(val);
-                }
-            }
-            return obj;
-        }
-        return v;
-    }
-}

package/dist/plugin/columns.d.ts

@@ -1,11 +0,0 @@
-import type { Store } from "./Store.js";
-export declare function hasColumn(store: Store, table: string, column: string): boolean;
-export declare function hasIgnoredColumn(store: Store): boolean;
-export declare function hasCuratedColumn(store: Store): boolean;
-export declare function hasTruthColumns(store: Store): boolean;
-export declare function hasRepoIdColumn(store: Store): boolean;
-export declare function hasLayerColumn(store: Store): boolean;
-export declare function hasRecurrenceColumn(store: Store): boolean;
-export declare function hasArchivedColumn(store: Store): boolean;
-export declare function hasFeedbackColumns(store: Store): boolean;
-export declare function hasFeedbackTable(store: Store): boolean;

package/dist/plugin/columns.js

@@ -1,54 +0,0 @@
-const cache = new WeakMap();
-export function hasColumn(store, table, column) {
-    const byStore = cache.get(store);
-    const key = `${table}.${column}`;
-    if (byStore?.get(key) === true)
-        return true;
-    try {
-        store.prepare(`SELECT ${column} FROM ${table} LIMIT 0`).get();
-        let m = byStore;
-        if (!m) {
-            m = new Map();
-            cache.set(store, m);
-        }
-        m.set(key, true);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-// v1.1.0 (K11-011 / plan §5.5, D11-06) — named helpers delegating to the registry
-export function hasIgnoredColumn(store) {
-    return hasColumn(store, "memories", "ignored");
-}
-export function hasCuratedColumn(store) {
-    return hasColumn(store, "memories", "curated");
-}
-export function hasTruthColumns(store) {
-    return hasColumn(store, "memories", "truth_penalty");
-}
-export function hasRepoIdColumn(store) {
-    return hasColumn(store, "memories", "repo_id");
-}
-export function hasLayerColumn(store) {
-    return hasColumn(store, "memories", "layer");
-}
-export function hasRecurrenceColumn(store) {
-    return hasColumn(store, "memories", "recurrence_count");
-}
-export function hasArchivedColumn(store) {
-    return hasColumn(store, "memories", "archived_at");
-}
-export function hasFeedbackColumns(store) {
-    return hasColumn(store, "memories", "feedback_positive");
-}
-export function hasFeedbackTable(store) {
-    try {
-        store.prepare("SELECT COUNT(*) FROM memory_feedback LIMIT 0").get();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/plugin/confidence.d.ts

@@ -1,8 +0,0 @@
-export declare const CONFIDENCE_MIN = 0.05;
-export declare const CONFIDENCE_MAX = 0.95;
-export declare const CONFIDENCE_BASE = 0.5;
-export declare const EVIDENCE_STEP = 0.1;
-export declare const RECURRENCE_PENALTY = 0.15;
-export declare const FEEDBACK_POSITIVE_STEP = 0.05;
-export declare const FEEDBACK_NEGATIVE_STEP = 0.1;
-export declare function computeConfidence(evidenceCount: number, recurrenceCount: number, positiveFeedback?: number, negativeFeedback?: number): number;

package/dist/plugin/confidence.js

@@ -1,34 +0,0 @@
-// v0.4.0 (K4-010) — shared two-sided confidence formula.
-//
-// Confidence is derived from both positive evidence (confirmed fixes) and
-// negative evidence (recurrences): recurrence of the same fingerprint
-// DEMOTES a pattern's confidence, so that a "causal pattern" with a
-// history of recurring failures stops being presented as reliable.
-//
-//	confidence = clamp(0.5 + 0.1 * evidenceCount - 0.15 * recurrenceCount, 0.05, 0.95)
-//
-// Used by `MemoryService.promoteToPattern`, `MemoryService.mapRow` and
-// `kevin_why` — keep the formula here, never inline it again.
-//
-// v0.5.0 (K5-010 / plan §5.3, D5-02) — human feedback joins the formula as
-// a second, independent evidence axis. Steps are deliberately SMALLER than
-// the causal steps: feedback is sparse, one-sided, and judgemental, while
-// evidence_count counts confirmed, reproducible fixes. A single negative
-// verdict (0.1) can offset one confirmed fix (0.1), but cannot alone sink
-// a well-evidenced pattern — the causal evidence must agree (plan §5.3,
-// "feedback cannot override causal evidence, only nudge it").
-export const CONFIDENCE_MIN = 0.05;
-export const CONFIDENCE_MAX = 0.95;
-export const CONFIDENCE_BASE = 0.5;
-export const EVIDENCE_STEP = 0.1;
-export const RECURRENCE_PENALTY = 0.15;
-export const FEEDBACK_POSITIVE_STEP = 0.05;
-export const FEEDBACK_NEGATIVE_STEP = 0.1;
-export function computeConfidence(evidenceCount, recurrenceCount, positiveFeedback = 0, negativeFeedback = 0) {
-    const raw = CONFIDENCE_BASE +
-        EVIDENCE_STEP * evidenceCount -
-        RECURRENCE_PENALTY * recurrenceCount +
-        FEEDBACK_POSITIVE_STEP * positiveFeedback -
-        FEEDBACK_NEGATIVE_STEP * negativeFeedback;
-    return Math.min(CONFIDENCE_MAX, Math.max(CONFIDENCE_MIN, raw));
-}

package/dist/plugin/contract.d.ts

@@ -1,54 +0,0 @@
-export declare const CONTRACT_VERSION = 1;
-export type Stability = "frozen" | "forward-only";
-export interface ContractClause {
-    readonly id: string;
-    readonly title: string;
-    readonly stability: Stability;
-    readonly since: string;
-    readonly deprecated?: string;
-    readonly replacement?: string;
-    readonly value: unknown;
-}
-export interface PublicContract {
-    readonly contractVersion: number;
-    readonly clauses: readonly ContractClause[];
-}
-export interface ContractInput {
-    readonly packageName?: string;
-    readonly packageVersion?: string;
-}
-export declare const CONTRACT_TOOL_NAMES: readonly string[];
-/**
- * v1.0.0 (K10-018/K10-019 / plan §5.6) — tools added AFTER the initial
- * freeze, each carrying the `since` the deprecation policy requires. A
- * 1.x addition without an entry here fails the contract test as
- * added_bare.
- */
-export declare const CONTRACT_TOOL_ADDITIONS: readonly {
-    name: string;
-    since: string;
-}[];
-/**
- * v1.1.0 (K11-007 / plan §5.1, D11-01) — metric keys added after the freeze,
- * each carrying the `since` the deprecation policy requires (C-05).
- */
-export declare const CONTRACT_METRIC_ADDITIONS: readonly {
-    name: string;
-    since: string;
-}[];
-/**
- * v1.0.0 (K10-027 / plan §5.7) — the C-09 boundary addition. Stored is
- * not trusted: anything reaching an artifact or a prompt is escaped at
- * the single write path, according to its container.
- */
-export declare const BOUNDARY_INVARIANT = "untrusted-input escaping at the single write path";
-export declare function describeContract(_input?: ContractInput): PublicContract;
-export declare function contractDigest(c: PublicContract): string;
-export type ContractDiffKind = "removed" | "changed" | "added_ok" | "added_bare";
-export interface ContractDiff {
-    readonly clauseId: string;
-    readonly path: string;
-    readonly kind: ContractDiffKind;
-    readonly remedy: string;
-}
-export declare function diffContract(golden: PublicContract, live: PublicContract): readonly ContractDiff[];